Home > Mac administration, macOS, macOS Recovery, System Integrity Protection > Google Keystone update breaks Macs’ ability to boot if System Integrity Protection is disabled

Google Keystone update breaks Macs’ ability to boot if System Integrity Protection is disabled

On the evening of Monday, September 23rd, a number of film and TV editors started reporting that their workstations were not rebooting successfully. The problem was initially blamed on the Media Composer software sold by Avid.

On September 24th, more instances were reported and it became clear that this was not an issue restricted to Macs with Media Composer installed. After extensive checking and testing, the folks in the MacAdmins Slack were able to narrow down the issue to an update to Google’s Keystone software, which Google uses to update Google Chrome and other Google products on macOS.

The now-pulled Keystone update attempts to remove the /var symlink, which is usually protected by Apple’s System Integrity Protection (SIP) security feature.

Image 2

On Macs where SIP was disabled, this protection did not apply and the Keystone update was able to remove the /var symlink. This symlink is not a directory itself, but points to another directory (/private/var) which contains software necessary for the operating system to boot and function correctly, so removing the /var symlink rendered the affected Macs unbootable.

As mentioned previously, Google has pulled the problematic Keystone update and has published instructions on how to remediate affected Macs. For more details, please see below the jump.

Note: Remediation is only needed on Macs experiencing problems resulting from this Keystone update. If your Mac is able to boot, remediation is not needed.

To remediate on Macs running OS X 10.9.x – OS X 10.10.x, where SIP is not available:

1. Boot to Recovery
2. Identify the Mac’s boot drive using the following steps:

A. Go to the Apple menu.
B. Select Startup Disk…

Screen Shot 2019 09 25 at 9 30 12 AM

C. Look for the highlighted drive. This is the startup disk.

Screen Shot 2019 09 25 at 9 30 33 AM

D. Note the name of the startup disk.

Note: By default, Apple sets the name of the boot drive to Macintosh HD.

3. Quit the Startup Disk application.

Screen Shot 2019 09 25 at 9 31 01 AM

4. Go to the Utilities menu
5. Select Terminal.

Screen Shot 2019 09 25 at 9 31 14 AM

6. Enter the following commands:

Note: If the name of your boot drive is different from Macintosh HD, the first command should be the following:

chroot "/Volumes/Different Name Goes Here"

Use the actual name of the boot drive in the command where I have Different Name Goes Here.

Screen Shot 2019 09 25 at 9 52 27 AM

7. Reboot your Mac and see if it now boots successfully.

Screen Shot 2019 09 25 at 9 54 01 AM

To remediate on Macs running OS X 10.11.x – macOS 10.14.x, where SIP is available:

1. Boot to Recovery
2. Identify the Mac’s boot drive using the following steps:

A. Go to the Apple menu
B. Select Startup Disk…

Screen Shot 2019 09 25 at 9 21 37 AM

C. Look for the highlighted drive. This is the startup disk.

Screen Shot 2019 09 25 at 9 27 36 AM

D. Note the name of the startup disk.

Note: By default, Apple sets the name of the boot drive to Macintosh HD.

3. Quit the Startup Disk application.

Screen Shot 2019 09 25 at 9 29 26 AM

4. Go to the Utilities menu
5. Select Terminal.

Screen Shot 2019 09 25 at 9 29 43 AM

6. Enter the following commands:

Note: If the name of your boot drive is different from Macintosh HD, the first command should be the following:

chroot "/Volumes/Different Name Goes Here"

Use the actual name of the boot drive in the command where I have Different Name Goes Here.

Screen Shot 2019 09 25 at 10 01 47 AM

7. Reboot your Mac and see if it now boots successfully.

Screen Shot 2019 09 25 at 10 04 16 AM

 

  1. martin
    September 25, 2019 at 8:22 pm

    Hi! this worked fine the first time, now the problem is back and the solution is not working

    • mardus
      September 26, 2019 at 8:50 am

      Yup, same here. It works until reboot.

      • Eric
        September 26, 2019 at 7:56 pm

        Ditto. I ran the exact same process again though, and it worked again. Any ideas how to make it permanent? What a crazy thing for a Google update to take down thousands of machines… Imagine all the people who weren’t lucky enough to stumble upon this solution.

  2. stockmind
    September 26, 2019 at 2:16 pm

    This didn’t work on my infected machines.
    `/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle` doesn’t exists because is in `~/Library/Google/` (under the home/user directory, not disk root)
    so `/Users//Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle`

    Because of that, what worked instead was:

    “`
    chroot /Volumes/Macintosh\ HD # “Macintosh HD” is the default
    rm -rf /Users//Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle
    mv var var_back # var may not exist, but this is fine
    ln -sh private/var var
    chflags -h restricted /var
    chflags -h hidden /var
    xattr -sw com.apple.rootless “” /var
    “`

    Where username is the user with the Google services installed

  3. stockmind
    September 26, 2019 at 2:17 pm

    This didn’t work on my infected machines.
    `/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle` doesn’t exists because is in `~/Library/Google/` (under the home/user directory, not disk root)
    so `/Users/USERNAME/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle`

    Because of that, what worked instead was:

    “`
    chroot /Volumes/Macintosh\ HD # “Macintosh HD” is the default
    rm -rf /Users/USERNAME/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle
    mv var var_back # var may not exist, but this is fine
    ln -sh private/var var
    chflags -h restricted /var
    chflags -h hidden /var
    xattr -sw com.apple.rootless “” /var
    “`

    Where USERNAME is the user with the Google services installed

  4. September 30, 2019 at 6:37 am

    Hello, has anyone solved that problem permanently?

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: